Merge branch 'dev' into update-semantic

Author: Vikas00230

.github/workflows/actionlint.yaml

@@ -1,19 +1,20 @@
 name: Lint GitHub Workflows
+
+permissions:
+  contents: read
+  actions: read
+
 on:
   pull_request:
     paths:
       - ".github/workflows/**/*.yml"
       - ".github/workflows/**/*.yaml"
+
   push:
     paths:
       - ".github/workflows/**/*.yml"
       - ".github/workflows/**/*.yaml"
+
 jobs:
   actionlint:
-    name: actionlint
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-      - name: Lint workflow files
-        uses: reviewdog/action-actionlint@v1
+    uses: HDRUK/github-actions-templates/.github/workflows/actionlint.yaml@main

.github/workflows/deployment.yaml

@@ -13,59 +13,17 @@ on:
           - preprod
           - prod
       tag_version:
-        description: 'Tag version to be deployed'
+        description: 'Tag version to deploy'
         required: true
         default: ''
 
-env:
-  PROJECT_ID: "${{ secrets.PROJECT_ID }}"
-  GAR_LOCATION: "${{ secrets.GAR_LOCATION }}"
-  SLACK_WEBHOOK_URL: "${{ secrets.SLACK_WEBHOOK_URL}}"
-  SLACK_CHANNEL: "${{ secrets.GITHUBACTIONS_SLACK_CHANNEL }}"
-
 jobs:
   deploy:
-    permissions:
-      contents: write
-      id-token: write
-
-    runs-on: ubuntu-latest
-    environment:  ${{ github.event.inputs.env }}
-    steps:
-      - name: Checkout
-        id: checkout
-        uses: actions/checkout@v6
-        with:
-          ref: main
-
-      - name: Google Auth
-        id: auth
-        uses: "google-github-actions/auth@v2"
-        with:
-          token_format: "access_token"
-          project_id: "${{ secrets.PROJECT_ID }}"
-          workload_identity_provider: "${{ secrets.WIF_PROVIDER }}"
-          service_account: "${{ secrets.WIF_SERVICE_ACCOUNT }}"
-
-      - name: Deploy to Cloud Run
-        uses: actions-hub/gcloud@540.0.0
-        id: deploy
-        env:
-          PROJECT_ID: ${{ secrets.PROJECT_ID }}
-          PROD_PROJECT_ID: ${{ secrets.PROD_PROJECT_ID }}
-          GAR_LOCATION: ${{ secrets.GAR_LOCATION }}
-          GAR_NAME: ${{ secrets.GAR_NAME }}
-          SERVICE_NAME: "${{ secrets.SERVICE_NAME }}"
-          SERVICE_REGION: "${{ secrets.SERVICE_REGION }}"
-        with:
-          args: run services update '${{ env.SERVICE_NAME }}' --image='${{ env.GAR_LOCATION }}'-docker.pkg.dev/'${{ env.PROD_PROJECT_ID }}'/'${{ env.GAR_NAME }}'/${{ github.event.inputs.tag_version }}:latest --region='${{ env.SERVICE_REGION }}' --project='${{ env.PROJECT_ID }}'
-
-      - name: Run Notification
-        id: runnotificationsent
-        uses: act10ns/slack@v1
-        with:
-          status: ${{ job.status }}
-          steps: ${{ toJson(steps) }}
-          channel: ${{ env.SLACK_CHANNEL }}
-          message: Deploying tag ${{ github.event.inputs.tag_version }} to ENV ${{ github.event.inputs.env }} ${{ job.status }}
-        if: always()
+    uses: HDRUK/github-actions-templates/.github/workflows/deploy-release.yml@main
+    with:
+      env: ${{ github.event.inputs.env }}
+      tag_version: ${{ github.event.inputs.tag_version }}
+      chart_path: chart/gateway-medcat/Chart.yaml
+      git_ref: main
+      run_scan: true
+    secrets: inherit

.github/workflows/dev_deployment.yaml

@@ -1,124 +1,46 @@
 name: Build and deploy to DEV
-run-name: ${{ github.actor }} triggered deploy to DEV pipeline
+run-name:  ${{ github.actor }} triggered deploy to DEV pipeline
 
 on:
   push:
     branches:
-      - "dev"
-
-env:
-  PROJECT_ID: "${{ secrets.PROJECT_ID }}"
-  GAR_LOCATION: "${{ secrets.GAR_LOCATION }}"
-  SLACK_WEBHOOK_URL: "${{ secrets.SLACK_WEBHOOK_URL}}"
-  SLACK_CHANNEL: "${{ secrets.GITHUBACTIONS_SLACK_CHANNEL }}"
+      - dev
 
 jobs:
-  build:
-    permissions:
-      contents: write
-      id-token: write
-
+  setup:
     runs-on: ubuntu-latest
     environment: dev
+    outputs:
+      docker_build_args: ${{ steps.args.outputs.docker_build_args }}
     steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          ref: dev
+      - uses: actions/checkout@v6
 
       - name: Read BASE IMAGE VERSION file
         id: getappversion
-        run: echo "appversion=$(sed -n 's/^MEDCAT_BASE_IMAGE_VERSION=\(.*\)/\1/p' < medcat_versions.yml)" >> "$GITHUB_OUTPUT"
-
-      - name: Read MEDCAT VERSION
-        id: getversion
-        run: | 
-          sed -n 's/^appVersion:\(.*\)/\1/p' < "chart/gateway-medcat/Chart.yaml" > "version"
-          echo "version=$(sed 's/.*\"\(.*\)\".*/\1/g' "version")" >> "$GITHUB_OUTPUT"
-
-      - name: Google Auth
-        id: auth
-        uses: "google-github-actions/auth@v2"
-        with:
-          token_format: "access_token"
-          workload_identity_provider: "${{ secrets.WIF_PROVIDER }}"
-          service_account: "${{ secrets.WIF_SERVICE_ACCOUNT }}"
+        run: |
+          echo "appversion=$(sed -n 's/^MEDCAT_BASE_IMAGE_VERSION=\(.*\)/\1/p' medcat_versions.yml)" >> "$GITHUB_OUTPUT"
 
-      - name: "Set up Cloud SDK"
-        uses: "google-github-actions/setup-gcloud@v2"
-        with:
-          version: ">= 363.0.0"
+      - id: args
+        run: |
+          ARGS=""
+          ARGS+="--build-arg MEDCAT_BASE_IMAGE_VERSION=${{ steps.getappversion.outputs.appversion }} "
+          echo "docker_build_args=$ARGS" >> "$GITHUB_OUTPUT"
 
-      - name: "Use gcloud CLI to download the models from google storage bucket"
-        run: gsutil -m cp -r '${{ secrets.BUCKET_PATH }}' .
-
-      - name: Login to GAR
-        id: garlogin
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.PROJECT_ID }}
-          username: oauth2accesstoken
-          password: ${{ steps.auth.outputs.access_token }}
-
-      - name: Build and Push Container
-        id: build
-        shell: bash
-        env:
-          GAR_LOCATION: ${{ secrets.GAR_LOCATION }}
-          PROJECT_ID: ${{ secrets.PROJECT_ID }}
-          GAR_NAME: ${{ secrets.GAR_NAME }}
-
-        run: |-
-          docker build -t '${{ env.GAR_LOCATION }}'-docker.pkg.dev/'${{ env.PROJECT_ID }}'/'${{ env.GAR_NAME }}'/${{ steps.getversion.outputs.version }}:${{ github.sha }} -t '${{ env.GAR_LOCATION }}'-docker.pkg.dev/'${{ env.PROJECT_ID }}'/'${{ env.GAR_NAME }}'/${{ steps.getversion.outputs.version }}:latest --build-arg MEDCAT_BASE_IMAGE_VERSION=${{ steps.getappversion.outputs.appversion }} ./
-          docker push --all-tags '${{ env.GAR_LOCATION }}'-docker.pkg.dev/'${{ env.PROJECT_ID }}'/'${{ env.GAR_NAME }}'/${{ steps.getversion.outputs.version }}
+  build:
+    needs: setup
+    uses: HDRUK/github-actions-templates/.github/workflows/docker-build.yaml@main
+    with:
+      chart_path: chart/gateway-medcat/Chart.yaml
+      environment: dev
+      docker_build_args: ${{ needs.setup.outputs.docker_build_args }}
+      download_models: true
+    secrets: inherit
 
   deploy:
     needs: build
-    permissions:
-      contents: write
-      id-token: write
-
-    runs-on: ubuntu-latest
-    environment: dev
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          ref: dev
-
-      - name: Google Auth
-        id: auth
-        uses: "google-github-actions/auth@v2"
-        with:
-          token_format: "access_token"
-          workload_identity_provider: "${{ secrets.WIF_PROVIDER }}"
-          service_account: "${{ secrets.WIF_SERVICE_ACCOUNT }}"
-
-      - name: Read MEDCAT VERSION
-        id: getversion
-        run: | 
-          sed -n 's/^appVersion:\(.*\)/\1/p' < "chart/gateway-medcat/Chart.yaml" > "version"
-          echo "version=$(sed 's/.*\"\(.*\)\".*/\1/g' "version")" >> "$GITHUB_OUTPUT"
-
-      - name: Deploy to Cloud Run
-        uses: actions-hub/gcloud@540.0.0
-        id: deploy
-        env:
-          PROJECT_ID: ${{ secrets.PROJECT_ID }}
-          GAR_LOCATION: ${{ secrets.GAR_LOCATION }}
-          GAR_NAME: ${{ secrets.GAR_NAME }}
-          SERVICE_NAME: "${{ secrets.SERVICE_NAME }}"
-          SERVICE_REGION: "${{ secrets.SERVICE_REGION }}"
-
-        with:
-          args: run services update '${{ env.SERVICE_NAME }}' --image='${{ env.GAR_LOCATION }}'-docker.pkg.dev/'${{ env.PROJECT_ID }}'/'${{ env.GAR_NAME }}'/${{ steps.getversion.outputs.version }}:${{ github.sha }} --region='${{ env.SERVICE_REGION }}' --project='${{ env.PROJECT_ID }}'
-
-      - name: Run Notification
-        id: runnotificationsent
-        uses: act10ns/slack@v1
-        with:
-          status: ${{ job.status }}
-          steps: ${{ toJson(steps) }}
-          channel: ${{ env.SLACK_CHANNEL }}
-          message: Deploying {{ env.GITHUB_REF_NAME }} branch to DEV ${{ job.status }}
-        if: always()
+    uses: HDRUK/github-actions-templates/.github/workflows/deploy-release.yml@main
+    with:
+      env: dev
+      chart_path: chart/gateway-medcat/Chart.yaml
+      git_ref: dev
+    secrets: inherit

.github/workflows/jira-fix-version.yml

@@ -0,0 +1,17 @@
+name: Tag Jira fix version
+run-name: ${{ github.actor }} tagging Jira fix version for ${{ github.ref_name }}
+
+# Runs on temporary release branches. Delegates to the reusable workflow, which
+# generates the release-notes preview, derives the version from the branch name
+# (release/1.12.0 -> 1.12.0), and tags the referenced Jira tickets.
+on:
+  push:
+    branches:
+      - "release/*"
+
+jobs:
+  jira:
+    uses: HDRUK/github-actions-templates/.github/workflows/jira-fix-version.yml@main
+    with:
+      jira_projects: "GAT"
+    secrets: inherit

.github/workflows/pr-title-check.yml

@@ -1,67 +1,15 @@
 name: PR Title Validation
 
+permissions:
+  contents: read
+  actions: read
+
 on:
   pull_request:
     types: [opened, edited, synchronize]
 
+
 jobs:
   check-title:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Generate GitHub App token
-        id: generate-deployment-token
-        uses: actions/create-github-app-token@v2
-        with:
-          app-id: ${{ secrets.DEPLOY_APP_ID }}
-          private-key: ${{ secrets.DEPLOY_APP_PRIVATE_KEY }}
-          owner: HDRUK
-          repositories: |
-            ${{ github.event.repository.name }}
-
-      - name: Check PR Title Format
-        env:
-          GITHUB_TOKEN: ${{ steps.generate-deployment-token.outputs.token }}
-          PR_TITLE: ${{ github.event.pull_request.title }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          PR_REPO: ${{ github.repository }}
-        run: |
-          TITLE="$PR_TITLE"
-          REPO="$PR_REPO"
-
-          echo "PR Title: $TITLE"
-
-          # Define regex patterns
-          RELEASE_PATTERN="^RELEASE: .+$"
-          STANDARD_PATTERN="^(feat|fix|chore|docs|style|refactor|test|perf)(!?)\(GAT-[0-9]+\): .+$"
-
-          if echo "$TITLE" | grep -E -q "$RELEASE_PATTERN"; then
-            echo "✅ PR title is a valid RELEASE PR!"
-
-            COMMENT="🎉 **Great job!** Your PR title follows the correct format for a release. 🚀"
-          elif echo "$TITLE" | grep -E -q "$STANDARD_PATTERN"; then
-            echo "✅ PR title is valid!"
-
-            COMMENT="🎉 **Great job!** Your PR title follows the correct format. 🚀"
-          else
-            echo "❌ Invalid PR title format!"
-
-            COMMENT="🚨 **Invalid PR title format!**\n\nYour PR title must follow one of these formats:\n- \`feat(GAT-1234): Your title\`\n- \`fix!(GAT-5678): Breaking change\`\n- \`RELEASE: vX.Y.Z\`\n\nPlease update your PR title accordingly. 😊"
-            
-            curl -s -X POST -H "Authorization: token $GITHUB_TOKEN" \
-              -H "Accept: application/vnd.github.v3+json" \
-              "https://api.github.com/repos/$REPO/issues/$PR_NUMBER/comments" \
-              -d "{\"body\": \"$COMMENT\"}"
-
-            exit 1
-          fi
-
-          # Check if an existing comment already exists
-          EXISTING_COMMENT=$(curl -s -H "Authorization: token $GITHUB_TOKEN" \
-            "https://api.github.com/repos/$REPO/issues/$PR_NUMBER/comments" | jq -r '.[] | select(.body | contains("Great job!")) | .id')
-
-          if [[ -z "$EXISTING_COMMENT" ]]; then
-            curl -s -X POST -H "Authorization: token $GITHUB_TOKEN" \
-              -H "Accept: application/vnd.github.v3+json" \
-              "https://api.github.com/repos/$REPO/issues/$PR_NUMBER/comments" \
-              -d "{\"body\": \"$COMMENT\"}"
-          fi
+    uses: HDRUK/github-actions-templates/.github/workflows/pr-title-check.yml@main
+    secrets: inherit